# Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)

- **Severity:** Critical
- **Signature ID:** `a2892c49-0f78-4b28-b68b-e87457346478`
- **CVEs:** CVE-2025-59536
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise), AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI05 (Cascading Failures in Multi-Agent Systems), ASI09 (Traceability and Accountability Gaps), LLM05 (Improper Output Handling), LLM06 (Excessive Agency)

## Summary

A booby-trapped code repository can make Claude Code run an attacker's command the moment a developer opens the project folder, before Claude Code even shows its usual 'do you trust this project?' warning. Just opening the folder is enough to trigger it.

## How the attack works

An attacker prepares a repository containing a `.claude/settings.json` file that registers a 'SessionStart' hook with a 'startup' matcher. A developer clones or opens this repository in Claude Code. Claude Code reads the repo-scoped settings file and fires the hook command immediately, before the trust dialog is shown. Whatever command is registered — a shell script, a curl-pipe-to-shell, an npm/pip install, or a python one-liner — executes with the developer's local privileges. The detection looks for this specific config shape (SessionStart + startup) rather than trying to judge whether the embedded command itself looks malicious.

## Why it matters

An attacker gets arbitrary code execution on a developer's machine simply by getting them to open a repository, with no explicit approval step, which can lead to credential theft, further supply-chain compromise, or full workstation takeover.

## What you can do

- Update Claude Code to a version with the enhanced trust-dialog fix (GHSA-ph6w-f82w-28w6) before opening untrusted repositories.
- Review `.claude/settings.json` in any repository before opening it in Claude Code, especially for SessionStart/startup hook entries.
- Treat repo-scoped Claude Code settings files as executable code and subject them to the same code review as scripts.
- Open unfamiliar or third-party repositories in an isolated or sandboxed environment rather than directly in a trusted developer workstation.

## Known benign look-alikes

- Legitimate Claude Code documentation discussing the Hooks schema, including example `SessionStart` configurations for defensive review or post-patch teaching purposes.
- Static analysis tooling output documenting CVE-2025-59536 attack patterns for defensive purposes.
- Patched Claude Code deployments that gate SessionStart hook execution behind the enhanced trust dialog (GHSA-ph6w-f82w-28w6) — detection still fires on the config shape, but the runtime impact is mitigated.
- Internal team templates that include reviewed `.claude/settings.json` fixtures with non-execution fields only (model, theme, allowed_tools).

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00523
- https://research.checkpoint.com/2026/claude-code-hooks-rce-cve-2025-59536/
- https://github.com/anthropics/claude-code/security/advisories/GHSA-ph6w-f82w-28w6
- https://nvd.nist.gov/vuln/detail/CVE-2025-59536

---
Source: https://www.netzilo.com/threats/atr-claude-code-hooks-sessionstart-pre-trust-rce-cve-2025-59536